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REMARKS 

Independent claims 7 and 19 remain in the present application. Claims 7 and 19 are rejected 
under 35 U.S.C. §103 as being unpatentable over U.S. Patent No. 6,529,954 (hereinafter 
"Cookmeyer") in view of Ma et al., "Mining Event Data for Actionable Patterns," 2000 (hereinafter 
"Ma"). 

Amended independent claim 7 recites a computer-based method of providing decision 
support to an analyst in accordance with an event management system which manages a network 
with one or more computing devices, the method comprising the steps of: automatically analyzing, 
off-line, data representing past events associated with the network of computing devices being 
managed by the event management system, the automated off-line analysis comprising generation of 
one or more visualizations of one or more portions of the past event data and discovery of one or 
more patterns in the past event data; and automatically managing rules off-line, the automated off- 
line rule management comprising construction and validation of one or more rules formed in 
accordance with the automated off-line analysis of the past event data, wherein one or more rules are 
constructed offline and validated offline based directly on at least a portion of the one or more 
visualizations generated offline from the corresponding offline analysis of the one or more portions 
of the past event data and the offline discovery of at least a portion of the one or more patterns in the 
past event data; wherein the past event data is obtained from an event database and the one or more 
rules are provided to a rule database, the event database and the rule database being associated with 
an execution system of the event management system; wherein generation of the one or more 
visualizations of the one or more portions of the past event data further comprises: selecting a subset 
of the past event data from the event database; generating a visualization of the subset of past event 
data using a visualization tool; the analyst reviewing the visualization to determine whether there are 
any groupings of events that are of interest presented therein; and performing an appropriate action 
when an event grouping of interest is found; wherein discovery of the one or more patterns in the 
past event data further comprises: selecting a subset of the past event data from the event database; 
mining the subset of the past event data to discover the one or more patterns using a mining tool; 
generating a visualization of the one or more patterns using a visualization tool; the analyst 
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reviewing the visualization to determine whether there are any patterns of interest presented therein; 
and performing an appropriate action when a pattern of interest is found; wherein validation of the 
one or more rules further comprises: selecting a subset of the past event data from the event 
database; finding one or more instances of patterns expressed in terms of left-hand sides of rules; 
generating a visualization of the one or more pattern instances using a visualization tool; analyzing 
the left-hand sides of rules using a rule validation tool; displaying results of the analysis operation; 
the analyst assessing analysis results; and marking the rules as one of validated and not validated 
based on the assessment by the analyst; wherein construction of the one or more rules further 
comprises: selecting a subset of the past event data from the event database; mining the subset of the 
past event data to discover the one or more patterns using a mining tool; assessing significance of the 
one or more patterns using a visualization tool; constructing the one or more rules from a selected 
subset of the one or more patterns using a rule construction tool; and writing the one or more rules in 
the rule database. Independent claim 19 recites similar limitations. 

Applicants traverse the rejections based on similar arguments presented in their previous 
response dated October 12, 2007, the disclosure of which is incorporated by reference herein. 

While Applicants address the Cookmeyer reference and Ma reference individually to refute 
the specific reasons offered by the Examiner to reject claims 7 and 1 9, it is to be understood that the 
arguments are directed at the combination of Cookmeyer and Ma. 

Despite the assertions in the Office Action, Cookmeyer does not disclose a combined off-line 
automatic data analysis and off-line rule management methodology, as in the claimed invention. 
Applicants again respectfully point out that the only "off-line" operation that Cookmeyer suggests is 
with regard to "expert analysis." In fact, Applicants reiterate that the only occurrences of the term 
"off-line" in Cookmeyer appear at col. 5, line 44; col. 5, line 58; col. 5, line 62; col. 21, line 46; and 
col. 5, line 53, and in each occurrence, it is clear that the term "off-line" is used only in the context 
of "expert analysis" and not in the context of a combined automatic data analysis and rule 
management methodology, as in the claimed invention. 

The relationship between the so-called expert analysis and the rules can be seen in the 
Abstract of Cookmeyer, which states that the rule-based expert analysis system of Cookmeyer 
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"allows the rules that are used in the analysis to be defined at run time, instead of fixed rules which 
are defined at design time and which use fixed threshold values" (underlining added for emphasis). 
Thus, any rules that Cookmeyer refers to are defined at run time (i.e., online) rather than at design 
time (i.e., offline). Hence, Cookmeyer does not disclose that one or more rules are constructed 
offline and validated offline based directly on at least a portion of the one or more visualizations 
generated offline from the corresponding offline analysis of the one or more portions of the past 
event data and the offline discovery of at least a portion of the one or more patterns in the past event 
data, as in the claimed invention. 

However, whether or not one can suggest that Cookmeyer discloses rule management that is 
associated with some form of expert analysis, it is clear that Cookmeyer does not disclose that one or 
more rules are constructed offline and validated offline based directly on at least a portion of the one 
or more visualizations generated offline from the corresponding offline analysis of the one or more 
portions of the past event data and the offline discovery of at least a portion of the one or more 
patterns in the past event data, as recited by the claimed invention. That is, there are no 
steps/operations disclosed in Cookmeyer for offline rule construction and offline rule validation that 
are based directly on at least a portion of the one or more visualizations generated offline from the 
corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data (again, underlining 
added for emphasis). Again, rules are handled in Cookmeyer at run time, not offline . 

For the sake of explanation, assume that in Cookmeyer, "Capture File" occurrences are 
representative of past events associated with the network of computing devices being managed by 
the event management system, and an off-line analysis of the "Capture File" occurrences is 
performed. Cookmeyer does not teach or suggest generating one or more visualizations of one or 
more portions of the "Capture File" occurrences and discovering one or more patterns associated 
with the "Capture File" occurrences. Rather, an analysis of the "Capture File" occurrences in 
Cookmeyer results in generating "events" and "symptoms" which are accumulated in a Results 
Journal. Furthermore, there is no suggestion in Cookmeyer that one or more rules are constructed 
offline and validated offline based directly on at least a portion of the Results Journal. In contrast, 
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the claimed invention recites performing "automated rule off-line management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data, wherein one or more rules are constructed offline and validated 
offline based directly on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data ." 

In characterizing the Ma reference as allegedly meeting certain limitations, the Examiner 
relies on various portions of Ma. However, no where in the relied-upon portions of Ma does the Ma 
reference teach or suggest constructing one or more rules offline by the rule construction module and 
validating offline by the rule validation module based directly on at least a portion of the one or 
more visualizations generated offline by the event visualization module from the corresponding 
offline analysis of the one or more portions of the event data and the offline discovery of at least a 
portion of the one or more patterns in the event data by the event mining module. 

In view of the foregoing, Applicants believe that claims 7 and 19 are in condition for 
allowance, and respectfully request withdrawal of the rejections. 




Respectfully submitted, 
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